Organizations exist for a purpose. They have a vision, goals and specific objectives aimed at achieving the goals and realizing the vision. Risks are those factors that jeopardize the achievement of the organizational objectives, goals, or vision—that create uncertainty that the desire results will be achieved. Organizations must identify risks that put their objectives in jeopardy and deploy controls to reduce the risk exposure.
Risks are created by underlying hazards. Risk is the measure of the uncertainty in both time and severity that a hazard will cause a loss. The proper measure for risk is exposure, which is the product of the probability of the loss and the severity of the loss. Since risk is a stochastic phenomena, the best representation of risk is a loss distribution function showing the probability of various severities of loss.
FIG. 1 shows a sample risk distribution for a single hazard. The total risk is equal to the area under the curve, the sum of all the individual probabilities(Likelihood) times severity(Size of single loss). Risk controls operate to reduce the area under the curve. However, these risk controls have an associated cost. In an ideal world the resources available for risk control are infinite and risks can be reduced to zero. In the real world, resources are limited. The risks can only be reduced to zero by abandoning the objective and a balance must be struck between the “good” to be achieved and the cost of risk controls and potential loss from the residual risk (risk remaining after risk controls are applied).
Furthermore, realization of the organizational vision requires the achievement of numerous objectives, all exposed to a vast number of different risks that need to be managed by a complex array of risk controls. Currently, most organizations manage these risks utilizing disconnected processes that are controlled by different functional areas within the organization. Evaluation by the organization's senior management of the efficiency and effectiveness of these various risk management efforts is hampered by at least two shortcomings.
Management is hampered by the lack of consistent methods for (a) identifying and measuring the risk exposures and (b) measuring the performance of the associated risk controls. This makes it extremely difficult for the organization to set priorities and to achieve an optimal allocation of resources toward risk control across the entire enterprise. This failure to establish an integrated enterprise-wide risk management system exposes an organization to two potentially dire consequences.
First, a major risk may be overlooked that will prevent the achievement of the organization's objectives. Second, resources will be wasted on inefficient and/or ineffective risk control efforts.
One of the necessary and primary objectives of any organization is that economic value be added. The organization's efforts need to create additional economic value or the organization will eventually exhaust its capital and wither away without having realized its vision. This is true of all organizations whether they be private or public corporations or non-corporate organizations.
One measure of economic performance is Stern Stewart & Co.'s Economic Value Added (EVA™) methodology. The basic theory states that economic value is added when future revenue cash flows exceed the expense and capital cash flows necessary to produce the revenue, more simply stated:EVA™=Operating Profit (OP)−Cost of Capital (CC), where Cost of Capital (CC)=Capital×Cost of Capital Rate (C*)Operating Profit can be further broken into two components:Operating Profit (OP)=Operating Revenue (OR)−Operating Expense (OE)So that the Economic Value Added (EVA) becomes:                               EVA          TM                =                ⁢                              (                                          Operating                ⁢                                                                   ⁢                Revenue                            -                              Operating                ⁢                                                                   ⁢                Expense                                      )                    -                                                ⁢                  (                      Capital            ×                          C              *                                )                                        =                ⁢                              (                          OR              -              OE                        )                    -                      (                          Capital              ×                              C                *                                      )                              
The aforementioned methodology requires that all of the cash flows should be adjusted for taxes, time and risk. The EVA™ methodology was originally developed as a performance metric for explaining the valuation of public stocks. Stern Stewart & Co. has further expanded its application as a guide for large-scale resource allocation when considering “profit center” investments and as the basis for tying management compensation to increases in shareholder value.
Before an organization can evaluate the performance of risk controls it must first identify and measure the risk exposures. This is a large, complex task, since organizations are faced with a huge number of hazards that generate varying degrees of risk exposure. Organizations generally divide responsibility for various risks among different functional groups within the organization in order to manage these risks.
The basis for the distribution of the responsibility varies from organization to organization and within the same organization. In many instances a functional group will be responsible for managing the risks that jeopardize the operations that they are responsible for. An example is the responsibility of the treasurer for the foreign currency exchange risk. In other instances a manager will have responsibility for risks that span across multiple functional areas where the manager does not have responsibility for the underlying operations. An example is the environmental manager whose is responsible for managing the environmental risks across the entire organization. Frequently responsibility is shared for various portions of the basic risk management process even if the distribution of responsibility is not well defined. FIG. 2 shows a basic risk management process of the related art.
Due to the historical distribution of responsibility for managing risks to isolate functions, the methodologies developed for the identification and measurement of risks vary greatly in their design, assumptions and outputs. Often management of the risks is performed using arcane technical language that varies from one functional area to another. Although the managers of these various risk are generally aware that the risk exposure has a probability and a severity component, they rarely use exposure to measure the risks and even more rarely use loss distribution functions to define the risk exposures.
Normally the manager considers the issues of probability and severity separately. Accordingly, sufficient data to define the loss distribution function is rarely available. This makes it extremely difficult for organizations to place consistent valuations on the risks and subsequently to determine how to optimize the allocation of resources across the entire enterprise. Frequently resources are allocated based upon either (a) Historical happenstance, i.e. the organization is aware of a recent large loss that increases its sensitivity to the risk associated with a particular hazard; or, (b) The organizational strength of the manager, i.e. a strong manager gathers more resources within the organization.
More sophisticated managers use various subjective ranking systems to order the relative severity, probability and control cost. Labels are attached to each hazard indicating a subjective valuation of the severity and probability. For example severity may be ranked as “high”, “medium”, or “low”. Probability may be ranked as “certain”, “likely”, “unlikely”, or “rarely”. The cost to control the risk is similarly ranked as “high”, “moderate” or “low”. A few of the ranking methodologies attempt to apply across all risks in the organization, but without establishing consistent operational definitions and measurement methodologies across the various functional areas. “High” and “Likely” frequently mean different things to different people. These methodologies also do not recognize the interdependencies that exist between various risk controls, nor do they tie back to the question of whether economic value is being created by the risk control efforts.
A few organizations use sophisticated mathematical analysis to define loss distribution functions for risks within a particular functional area. These efforts, however, are restricted to a handful of risks due to the effort to rigorously define the loss distribution functions. Currently there are a number of historical forces at work that are moving organizations toward a more systematic management of risks across the entire enterprise. Broadly speaking these are:                The Corporate Governance movement,        COSO's (Committee of Sponsoring Organizations) Internal Control—Integrated Framework,        The 1991 Federal Sentencing Guidelines for Organizations,        The Imperatives of World Class Performance        
Under the Stern Stewart & Co. methodology, a company will often allocate resources to activities that produce the greatest EVA and will reward those managers who generate EVA. Activities and managers, who do not produce EVA, will be easily identified and will provide a company with the opportunity to free up capital and direct it towards those who utilize it most effectively.
EVA analysis was first applied to decisions regarding investments in the context of “profit centers.” For instance, managers are now asked in advance to evaluate the efficacy (i.e. does the activity produce positive EVA) of expanding production capacity for a particular product line? Similarly, EVA is now being applied to “cost centers” as well. Managers of “cost centers” are being asked to justify new activities or even the existence of their function on the basis of EVA.
At first glance this may seem difficult because by definition a “cost center” does not generate revenue and it would appear that only a reduction in the operating expense and capital requirements to zero would improve the situation. According to the EVA methodology, the best result that can be achieved with respect to a cost center is a reduction in its negative impact on EVA. Therefore, a cost center or activity lacking revenue generating capabilities, would seemingly lack the ability to achieve a positive EVA.
For example, consider the annual cost of preventative maintenance on a piece of machinery. The expenditure of capital to maintain the piece of machinery does not produce new revenue nor does it decrease the operating expense. Therefore, the conventional EVA methodology teaches that managers should evaluate the impact of preventative maintenance activities on EVA as producing a negative result. However, it appears that the wrong questions are being asked in the evaluation of the Economic Value Added.
The division of a productive system into “profit” and “cost” centers is an arbitrary allocation of operating revenues to only a portion of the system that is required to produce and sell the product or service to the customer. For example, the evaluation of an investment in a new piece of machinery reveals the following:
(1) An initial capital outlay either produces a new revenue stream with a given operating cost over the life of the machine, or
(2) The initial capital outlay replaces an existing revenue stream at a reduced operating cost or
(3) A combination of the two.
In either case, one must be careful to capture the total operating expense over the lifetime of the machine. In order to capture the total operating expense over the lifetime of the machine, an accurate evaluation should include the preventive maintenance cost necessary to keep the machine productive over its expected lifetime.
Cash flows equally need to be adjusted for risk. However, methodologies and systems of the background art fail to provide a single system that offers the operator or manager the ability to accurately assess the Economic Value Added of all activities within an organization.
For instance, cost allocation and activity-based costing are additional examples of accounting systems that assign or link some cost(s) with related cost objectives. Salaries for a group of employees in an operating unit are indicative of costs (salaries) associated with the maintenance of a cost objective (the operating unit). Similarly, raw materials costs are often assigned or allocated to a product or group of products (cost objective). However, as in all of the foregoing examples, the preventative maintenance costs associated with a machine in an manufacturing process would be considered “negatives” under all of the previous approaches.